It isn't going to work to know about HttpServletRequest here. Pass in security pieces.